Thunderbird and Avast - strange behaviour

Avast Free Antivirus / Premium Security
1

Dear All,

First some version Info:
Windows XP SP2 Prof - fully patched and updated
Avast Home 4.6.793,VPS 0549-3
Thunderbird Version 1.0.7 (20050923)

  • no personal firewall, expect the standard windows firewall (have a hardware one) or other resident spy, adware or virus scanners

All Mail accounts in thunderbird are IMAP Accounts,using standard ports for IMAP (143) and SMTP (25) no encryption.

I have recently switched from Outlook Express to Thunderbird and see some strange behaviour of Thunderbird togheter with Avast:

A) during startup thunderbird makes a check of the functionality of the mail server. If I configure Internet Mail provider for checking outgoing mail I get a pop up box from thunderbird “This mail server is no IMAP4 Server”. Even pausing the Internet Mail does not help - if I configure Internet Mail for not checking outgoing mails or stop the internet mail provider or stop avast completly this box is not displayed.

B) If I send mail I get a pop up box from thunderbird with the message “Could not connect to SMTP Server xxx …” - same behaviour as above. Not checking for outgoing mail or shut down internet mail provider helps. Checking for outgoing mail and pausing the provider does not help.

I have also tried a repair of avast, have no special settings - use Avast as it was delivered with default settings.

Does anyone have an idea waht might be the reason for this or how I can check what may cause this behaviour. And Yes, I have searched in the Forum but found nothing like this. Not Checking outgoing mails is for me a workaround, which I don’t want to keep for a long time.

thanks a lot
Peter

2

Thanks for your post ! I had last night the exact same issue.
My config is same as yours.

I use Thunderbird for an IMAP account, had this popup for a couple of sessions and then disappeared without doing anything.
I also notice that after scanning inbound emails i don’t get any message in the header with the succesful scan ( all flags on in properties ) but I get it on outbound messages.

Last , the systray icon with message folder and blue light ( checking the forum I found couple of topics on this and it seems an alert for email scanning ) is permanently shown when I open thundrbrd. even if my client checks for new emails every 5 mins. Also the details of the server (mail.xxxx.@xxx.com) are not the ones of my account , maybe the server that is hosting my domain ??
I’m not an expert of networking so I’m probably missing something…
thx.

3

Hi Tuca,
Ok - so I’m not the only one, but still no solution.

Some Answeres To Your points:
The message header is insertes, if You realy download the message in Offline mode, but not if you look at them in Online mode - in Online mode the message is always fetched directly from the server even if You have it downloaded before - You may try that with switching in Offline mode - of course You have to configure first Offline mode for your folders an then look at the message - then You have it inserted (at least this is how it works on my setup)

The systray Icon which shows the scanning of messages is always on, cause thunderbird keeps IMAP sessions open, therefore you get an immediate information if a new mail arrives, but of course the systray icon is always on. Outlook Express is openening the IMAP Sessions fetches the Headers or MEssages (depending on Your configuration) and closes the connection afterwards.

The server details in the systray should be reflect your settings (IMAP Server, SMTP Server) - if you have another server then it might be that some other program tries to send/receive data via the mail ports - then I would suggest to check your system for some malware.

br
Peter

4

Peter,

thx for ur post solved most of my questions .
I did a research for the wrong server name appearing on the icon and found out with my hosting help desk that it is the name of the remote server where my domain is sitting. So no malware on this side.

Hopefully somebody can help on the IMAP4 error message you mentioned. Are u still facing it ?

5

See: http://forum.avast.com/index.php?topic=13329.msg112751#msg112751

I’m not an expert on Thunderbird, but I’ve read here in forums that, maybe if you use it with IMAP you can go to TB Sent folder: Tools > Account Settings > Server Settings > Advanced and set “Maximum number of server connections to cache” to more than 4.
This is related to TB timeouts: http://forum.avast.com/index.php?topic=11596.msg106618#msg106618
Hope this help in anyway…

The problem seems to be caused by Thunderbird using a special IMAP feature - downloading the messages by pieces - i.e. it doesn’t download the whole message, it doesn’t even download the particular attachments as whole - but it simply downloads the message cut into smaller pieces, one by one (at least I suppose so - theoretically, it may get the pieces even randomly - one here, one there…).
This feature, unfortunatelly, breaks avast! scanning - the virus is not recognized from a small piece of message only.

6

I am quite familiar with Thunderbird and its ways but I have not, previously, used it with an IMAP account.

I should say that I am presently using Thunderbird 1.5 RC1 (sorry I do not plan to revert to 1.0.7 - however I do not recall that any changes to IMAP were advertised for the 1.5 release - but one can never be sure).

So in the interests of trying to reproduce this problem I signed up for an IMAP account, stacked it up with some messages and then set it up in Thunderbird allowing Thunderbird to go with all of its defaults as I set up the IMAP account. Thunderbird went for my default SMTP account to support the IMAP incoming side.

I used the non-encrypted connection to the account. Thunderbird immediately proceeded to download all the messages in the inbox and, on investigation, every message in the Inbox on Thunderbird had the X-Antivirus headers inserted by avast!.

Tech fyi, at least in the 1.5 release of Thunderbird the default for “Maximum number of server connections to cache” is 5.

I cannot reproduce the error you are seeing with your IMAP server. I am not suggesting the problem does not exist but you may wish to double check that you have entered the correct server name in Thunderbird (in the service I signed up for the server name is totally different from the name of the domain for the email address).

SMTP is just plain old fashioned SMTP that untold thousands of us use every day in Thunderbird and has nothing to do with IMAP. I cannot explain the error you see other than those instances where I see the message and - the server is just down.

Just to get an avast! perspective on what is happening you may wish to create (for a while) a more detailed avast! log of your mail connections.

You can get the mailscanner to log your connections by editing the avast4.ini file (in Program Files\Alwil Software\Avast4\DATA folder).

In the section headed:

[MailScanner]

add the line:

Log=20

and save the updated file.

The log will be in Program Files\Alwil Software\Avast4\DATA\log\ashmaisv.log

If you wish to post the log for us to look at please make sure to remove any personally identifiable information before you post.

7

Thanks for Your suggestions and Feedbacks and especially alanrf for making a special test.

Seems that I have solved my problem and that it may be a small problem with avast.
I have four IMAP Accounts, every Account has had the number of IMAP Seesions set to 5 (totally 20 active open IMAP Seesions). I have now decreased the number of IMAP Seesions and have now totally 11 active open IMAP sessions. Now everything is working. Seems for me that avast had some problems to handle this 20 IMAP sessions and then the new SMTP session for sending - I will do in the next days some testing with the log level increased and post back the results I have found.

For Tech suggestion with the special IMAP handling of thunderbird, loading messages in pieces and breaking the mail scanning of avast,which may be the reason that no clean message is seen in the headers (problem mentioned by tuca) - please see this post to change this behavior of thunderbird by changing some settings.

http://forum.avast.com/index.php?board=2;action=display;threadid=8967;start=15

And for a complete downloading of the mails as soon as thunderbird detects a new one you may want to install the “Sync on arrival” extention in thunderbird.

br
Peter

8

Seems to me some fine diagnosis of the problem Peter!

However, I notice that this is not the first time that you have made a contribution on the “number of sessions” issue.

Back in December 2004 (my infancy on avast!) I did not detect any contribution from the avast! development team. Perhaps they could address that oversight and let us know if they are aware of an IMAP sessions limit issue and whether there is a heretofore undisclosed (or even disclosed - if disclosed we may have to lynch Tech) ini override or other magical solution.

9

Yes, there is a limit of 20 simultaneous connections for all protocols handled by the mail scanner together. You can configure it in the avast4.ini file, see ‘MaxConnections’ here: http://forum.avast.com/index.php?topic=1647.msg10267#msg10267

10

Thanks for the hint vojtech !!!

I will check this setting after I returned home from office and post the results - hmmpf, I could bite myself that I have not checked the excellent settings thread from tech.

br
Peter

11

What can I say ?

Thanks!! All looks clear now , even if my IMAP4 erro message appeared just once few days ago ( probably a problem of the server ? ) . Since then all looks fine also the message in the scanned emails !

I will change few settings of Thunderbird tonight following ur suggestions.

alanrf thx for the test really appreciated.

12

Thanks for your kindly words, Peter.
I’m honored with a Vojtech’s quote :wink:

13

The “MaxConnections” setting did it ;D !!!

Thanks for the hints to solve my little problem.

br
Peter